MEGApwn

Bookmarklet to recover your secret MEGA master key

"Technically, we could serve you backdoored JavaScript code that sends your master encryption key back to us."MEGA

Your MEGA master key is supposed to be a secret, but MEGA or anyone else with access to your computer can easily find it without you noticing.

Frequently asked questions

What is MEGApwn?

MEGApwn is a bookmarklet that runs in your web browser and displays your supposedly secret MEGA master key, showing that it is not actually encrypted and can be retrieved by MEGA or anyone else with access to your computer without you knowing.

What is a bookmarklet?

A bookmarklet is a bookmark stored in a web browser that contains JavaScript commands to extend the browser's functionality. You can read more about bookmarklets on Wikipedia.

Can MEGA read my files?

Yes. Your web browser trusts whatever it receives from MEGA, which means they can grab your master key whenever you visit their site and then use it to decrypt and read your files. You'd never know.

Can other people read my files?

Yes. Any warrant or subpoena issued to MEGA for your files simply has to ask for your master key, which MEGA can retrieve, and prohibit MEGA from telling you about it. Also any browser extension you have installed can access this information without your knowledge.

No, it simply demonstrates one of the many serious and insoluble problems you face when doing cryptography in Javascript web applications. There are many other problems like this which is why numerousrespectedcryptographers have warned against doing this for years.

This is stupid, of course MEGA can get my keys! I just trust them not to.

When you get down to the root of the issue, MEGA's approach to cryptography is secure if, and only if, you trust MEGA not to extract your keys. From where I sit that's not all that different from having to trust any other moretraditional cloud storage provider not to read your files.

How it works

Once you have installed the bookmarklet, log into MEGA. Clicking the button will show you something like this:

The MEGA web site stores your secret master key in the local storage area of your web browser where any code running on your computer, in your browser, or on MEGA can easily retrieve it. While MEGApwn simply displays enough information to prove the correct key has been recovered, similar code could just as easily send your master key to anywhere on the Internet, including back to MEGA.